3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.zip
- SHA256 ca67f2fc66143d4e27e94ca3b0488b5d69555a736ccf3280e5e32878dd8a214c
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.zip
- Size 282KB
- Sample260807-pcvrbsvdqa
- SHA256 ca67f2fc66143d4e27e94ca3b0488b5d69555a736ccf3280e5e32878dd8a214c
- MD5 8dda0fc8b756c080b1691132d399dff7
- SHA1 e2b2094a4cd35b37e658c58977ea9a72656705ad
- SHA512 d1a1665211a9458ca693be3087a744e67b784781dfec6ccfc32c5cba76c513ed3cf95a85ed8272f0ea1f328451571bfb58a6bf3f43dcd3d143a11147cf847105
- SSDEEP 6144:ZBVH2nHLPozunan5k+juqHVPpb6gzjSzPpZOX7j0sEwsvDMJ:F2nHEgo5kouq1PB617pm7jjGMJ
- TLSH T1C55423F3BC5548ECDC2B51D7EB96C6120DBA4EEFF610A897DCB9239174F42CA15244A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187 suspicious_telegram_bot - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187
File Explorer
-
3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.zip.zip 282KB
-
3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187.exe 601KB
3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187
- IMPHASH 21d3e0c535f8f12bb16334eb363165a7
- SHA256 3780499eb9a9f351a01b9e8eb40e124790741c0c538403755104c494526bb187
- MD5 5397197dc8142038b564eaf1de970f03
- SHA1 43f2f8bbbf635b2298e4ce7c6f9146f67031a187
- SHA512 ed5f44242275520c855bd8d10785e52a847925139757c95646e33888574813e3fa734c19c6c55fe1d83fa16e7c6a006dcbaec04bb3960ae10f7e546c851e8702
- SSDEEP 6144:zN7n63HpIOyo2Vy6MMSAoqiFaQNKglICXuWefy0ZDdNsOfivVzJcSX6MkVFOu/ND:zcaI6KYQ4qIDRjVFzL36WppgKkBU
- TLSH T110D45D26A65400FCE1B3D2F99E565802E672784A0334AEDF03D159A31F177E89F7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
PE Signature issue
Digest
e0:7d:b1:87:f7:ce:af:e1:ec:1e:6e:4b:05:7f:5a:ca:56:50:d6:13
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=blackninjas
Chains
Aug 6, 2026
CN=blackninjas
Subject
CN=blackninjas
Serial Number
21:05:71:fd:4d:67:84:b9:42:dd:f4:cc:02:3d:52:a0
Issuer
CN=blackninjas
Timespan
Aug 6, 2026 - Aug 6, 2029
Minor OS version
0
Major OS version
6
Entry point
302624
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\richi\source\repos\blackninjas\x64\Release\blackninjas.pdb
winhttp
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpQueryDataAvailable
gdiplus
GdiplusShutdown
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipSetInterpolationMode
GdipGetImagePixelFormat
GdipFree
GdipGetImageGraphicsContext
GdipGetImageEncodersSize
GdipDeleteGraphics
GdipSaveImageToStream
GdipCreateBitmapFromScan0
GdiplusStartup
crypt32
CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCreateSelfSignCertificate
CertDeleteCertificateFromStore
CryptEncodeObject
CertSetCertificateContextProperty
CertGetNameStringW
CertSetEnhancedKeyUsage
CertOpenStore
CertGetCertificateContextProperty
CertStrToNameW
CertFindCertificateInStore
cryptui
CryptUIWizDigitalSign
wintrust
WinVerifyTrust
kernel32
GetConsoleMode
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
GetCommandLineA
GetCommandLineW
GetConsoleOutputCP
FlushFileBuffers
TerminateProcess
CreateMutexW
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
Process32FirstW
CloseHandle
GetCurrentProcessId
QueryFullProcessImageNameW
GetTickCount64
GetSystemInfo
GetComputerNameW
GlobalMemoryStatusEx
GetProcessHeap
GetLogicalDrives
SetHandleInformation
GetCurrentProcess
GetModuleFileNameW
CreatePipe
GetEnvironmentVariableW
PeekNamedPipe
WaitForSingleObject
FreeEnvironmentStringsW
FileTimeToSystemTime
GetDiskFreeSpaceExW
GlobalAlloc
DeleteFileW
GlobalFree
GetProcAddress
GlobalLock
CreateProcessW
GetModuleHandleW
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GlobalUnlock
GetDriveTypeW
MoveFileExW
CopyFileW
GetSystemTime
MultiByteToWideChar
GetLocalTime
WideCharToMultiByte
HeapFree
HeapAlloc
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
WriteFile
GetStdHandle
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
FreeLibrary
SetStdHandle
CreateFileW
HeapSize
WriteConsoleW
SetEndOfFile
RtlUnwind
VirtualProtect
LoadLibraryExW
LCMapStringW
GetLocaleInfoW
IsValidLocale
ExitThread
CreateThread
GetFileType
GetUserDefaultLCID
ReadFile
SetFilePointerEx
GetFileSizeEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
WaitForSingleObjectEx
GetExitCodeThread
WakeConditionVariable
WakeAllConditionVariable
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
GetTempPathW
CreateFile2
AreFileApisANSI
DeviceIoControl
CopyFile2
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
LocalFree
FormatMessageA
GetLocaleInfoEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnumSystemLocalesW
user32
GetDC
MessageBoxW
EnumDisplayMonitors
GetSystemMetrics
OpenClipboard
GetMonitorInfoW
CloseClipboard
EmptyClipboard
GetClipboardData
GetClipboardSequenceNumber
SetClipboardData
ReleaseDC
gdi32
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
SelectObject
advapi32
GetTokenInformation
RegDeleteValueW
RegOpenKeyExW
CryptAcquireContextW
OpenProcessToken
GetUserNameW
RegCloseKey
RegSetValueExW
shell32
ShellExecuteW
ole32
CreateStreamOnHGlobal
iphlpapi
GetAdaptersAddresses
ws2_32
inet_ntop
Name
.text
Size
451KB
Virtual Size
451KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
118KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=176, id=261, version=33145,
count=18, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=95, id=261, version=35721,
count=27, id=257, version=33145,
count=238, id=1, productName=Unmarked objects,
count=7, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=151,
count=1, id=258, version=36252,